WO2011034052A1

WO2011034052A1 - Vehicle electronic control device

Info

Publication number: WO2011034052A1
Application number: PCT/JP2010/065822
Authority: WO
Inventors: 池上裕介
Original assignee: 株式会社ケーヒン
Priority date: 2009-09-17
Filing date: 2010-09-14
Publication date: 2011-03-24
Also published as: EP2479672A4; JP2011065402A; JP5582748B2; EP2479672B1; US9547569B2; EP2479672A1; US20120173071A1

Abstract

Disclosed is a vehicle electronic control device equipped with a first microcomputer (2, 3), and a second microcomputer (3, 2) that is able to transmit and receive signals with the first microcomputer; wherein one microcomputer (2, 3) from among the first microcomputer and the second microcomputer outputs a PWM signal to the other microcomputer (3, 2), the other microcomputer detects the on-time of the PWM signal, performs a self-diagnosis corresponding to the detected on-time, and outputs the self-diagnosis results to the one microcomputer, and the one microcomputer diagnoses the other microcomputer on the basis of the self-diagnosis results.

Description

Electronic control device for vehicle

The present invention relates to a vehicular electronic control device, and more particularly to a vehicular electronic control device that diagnoses a microcomputer.

In recent years, in an electronic control unit (ECU) for a vehicle, the importance of a microcomputer (hereinafter referred to as a microcomputer as appropriate) included in the electronic control unit has been increased along with the advancement of electronic control in a vehicle. ing.

For example, in an electronic control device for a vehicle, a target command value is obtained in a microcomputer, and various devices related to an engine or the like are driven based on the target command value. It has been proposed to monitor the operation of the microcomputer.

In Patent Document 1, a homework signal 20 is transmitted from the monitoring circuit 2 to the microcomputer 1, and the microcomputer 1 performs a self-function check calculation according to the content of the homework signal 20, and the calculation result is sent to the monitoring circuit 2 as an answer signal 10. Send back. The monitoring circuit 2 monitors whether the microcomputer is operating normally by comparing the content of the answer signal 10 transmitted from the microcomputer 1 with the correct answer. Here, transmission / reception of the homework signal 20 and the answer signal 10 is performed by serial communication.

JP 2004-259137 A

However, according to the study of the present inventor, the sub-microcomputer (hereinafter referred to as sub-microcomputer as appropriate) in the monitoring system is not used only for monitoring the operation of the main microcomputer (hereinafter referred to as main microcomputer as appropriate). In addition, when the main microcomputer executes complicated arithmetic processing on data necessary for controlling various devices, the main microcomputer supports the arithmetic processing of the main microcomputer.

For this reason, when the homework signal 20 and the answer signal 10 are transmitted by serial communication as in the configuration of Patent Document 1, priority is given to data communication between the main microcomputer and the sub-microcomputer related to complicated arithmetic processing. There may be a tendency that data communication for monitoring the operation of the microcomputer is postponed and the main microcomputer cannot be diagnosed quickly.

The present invention has been made through the above-described studies, and an object thereof is to provide a vehicle electronic control device capable of diagnosing a microcomputer quickly and reliably.

In order to achieve the above object, the present invention provides a vehicle electronic control device comprising a first microcomputer and a second microcomputer capable of transmitting and receiving signals between the first microcomputer. Of the first microcomputer and the second microcomputer, one microcomputer outputs a voltage signal representing a high level voltage and a low level voltage to the other microcomputer, and the other microcomputer Detecting a high time when the voltage of the voltage signal is at the high level and executing a self-diagnosis according to the detected high time, outputting the result of the self-diagnosis to the one microcomputer, Based on the result of the self-diagnosis, the microcomputer uses the other microcomputer. The first feature to the diagnosis data.

Further, in addition to the first feature, the present invention has a second feature that the voltage signal is a PWM signal.

According to the present invention, in addition to the second feature, the other microcomputer is configured such that the one microcomputer is based on at least one of the high time and the period of the PWM signal input from the one microcomputer. The third feature is that the computer is diagnosed.

According to the present invention, in addition to any one of the first to third features, the other microcomputer outputs the self-diagnosis result to the one microcomputer as a PWM signal, and the one microcomputer A fourth feature is that the other microcomputer is diagnosed based on at least one of a high time and a period of the PWM signal.

According to the present invention, in addition to the first or second feature, the other microcomputer outputs the self-diagnosis result to the one microcomputer via serial communication. And

Further, according to the present invention, in addition to any of the first to fifth features, the other microcomputer performs diagnosis of the one microcomputer, and the other microcomputer by the one microcomputer. If one of the diagnosis of the first microcomputer and the diagnosis of the one microcomputer by the other microcomputer is negative, the operation of the control target of the vehicle electronic control device is prohibited.

According to the above-described vehicle electronic control device according to the present invention, the microcomputer is diagnosed mainly using the PWM signal instead of the serial communication, so that the microcomputer can be diagnosed quickly and reliably.

It is a block diagram which shows the structure of the electronic controller for vehicles in embodiment of this invention. It is a sequence chart which shows the operation | movement sequence of the mutual monitoring process performed between the main microcomputer and submicrocomputer of the vehicle electronic control apparatus in this embodiment. It is a flowchart which shows the flow of a process at the time of the submicrocomputer of the electronic controller for vehicles in this embodiment monitoring and diagnosing the operation | movement of a main microcomputer. 4 is a timing chart mainly corresponding to the processing shown in FIG. 3. It is a flowchart which shows the flow of the process which a main microcomputer performs with the process at the time of the submicrocomputer of the electronic controller for vehicles in this embodiment monitoring and diagnosing the operation | movement of a main microcomputer.

Hereinafter, an electronic control device for a vehicle according to an embodiment of the present invention will be described in detail with reference to the drawings as appropriate.

FIG. 1 is a block diagram showing the configuration of the vehicle electronic control device according to this embodiment.

As shown in FIG. 1, an electronic control unit (ECU: Electronic Control Unit) 1 for a vehicle in the present embodiment is a device for controlling the operation of an electronic throttle motor M, and includes a main microcomputer 2, a sub-microcomputer 3, An AND circuit (AND circuit) 4, a relay drive circuit 5, a relay 6, a motor drive circuit 7, and a monitoring circuit 8 are provided, and electric power necessary for the operation is supplied from the battery 9 via the ignition switch SW. It should be noted that the control target of the electronic control device 1 is not limited to the electronic throttle motor M, but includes other loads that can operate in the vehicle.

The main microcomputer 2 is a microcomputer including a CPU (Central Processing Unit) 2a. Here, the CPU 2a operates in accordance with a control program stored in a memory (not shown) of the main microcomputer 2 to control the entire operation of the electronic control unit 1 and diagnoses the operation of the sub microcomputer 3. It is free.

The sub-microcomputer 3 is a microcomputer including a CPU 3a. Here, the CPU 3a can support the processing of the main microcomputer 2 according to the control signal from the main microcomputer 2 by operating according to the control program stored in the memory (not shown) of the sub-microcomputer 3, and the main microcomputer 2. The operation of the microcomputer 2 can be diagnosed. The main microcomputer 2 and the sub microcomputer 3 can also transmit and receive signals SI1, SI2, and SI3, which will be described later in detail.

The two input terminals of the AND circuit 4 are connected to the outputs of the main microcomputer 2 and the sub-microcomputer 3, respectively, and the output terminals are connected to the relay drive circuit 5. When both the relay drive control signal SI4 output from the main microcomputer 2 and the relay drive control signal SI5 output from the sub-microcomputer 3 are at a high level, the AND circuit 4 outputs a high level relay drive signal SI6. Output to the relay drive circuit 5. On the other hand, when at least one of the relay drive control signal SI4 output from the main microcomputer 2 and the relay drive control signal SI5 output from the sub-microcomputer 3 is at a low level, the AND circuit 4 The drive signal SI6 is output to the relay drive circuit 5.

When the level of the relay drive signal SI6 output from the AND circuit 4 is switched from the low level to the high level, the relay drive circuit 5 switches the relay 6 from the off state to the on state, thereby reducing the power of the battery 9. This is supplied to the motor drive circuit 7. On the other hand, when the level of the relay drive signal SI6 output from the AND circuit 4 is switched from the high level to the low level, the relay drive circuit 5 switches the relay 6 from the on state to the off state, thereby The supply of power to the motor drive circuit 7 is stopped.

The motor drive circuit 7 controls the drive of the electronic throttle motor M using the power of the battery 9 in accordance with a control signal from the main microcomputer 2 when the relay 6 is in an on state.

The monitoring circuit 8 performs a time measuring operation while monitoring whether the main microcomputer 2 is operating using the pulse signal WDT output in relation to the operation of the main microcomputer 2, and stops or stops the pulse signal WDT. When a delay occurs, the main microcomputer 2 and the sub microcomputer 3 are reset by sending a reset signal SI7 to the main microcomputer 2 and the sub microcomputer 3.

Next, the monitoring process in the vehicle electronic control device 1 having the above-described configuration will be described in detail with reference to FIGS. The monitoring process in the electronic control device 1 is a mutual monitoring process that the CPU 2a in the main microcomputer 2 and the CPU 3a in the sub-microcomputer 3 execute in cooperation. Hereinafter, a case where the sub microcomputer 3 monitors and diagnoses the main microcomputer 2 and the main microcomputer 2 performs self diagnosis and also diagnoses the sub microcomputer as an example will be described. .

Here, in the present embodiment, a PWM (Pulse Width Modulation) signal is representatively applied and described as a voltage signal used for the mutual monitoring process. The PWM signal has a low level voltage and a high level voltage that is switched from the low level voltage to a predetermined on-time, and a predetermined high time during which the high level voltage is maintained. Corresponds to the output width of the PWM signal, and the period in which the high level voltage appears corresponds to the output period of the PWM signal. Of course, as such a voltage signal, a general voltage signal having a high level voltage and a low level voltage is applicable. In the case of such a general voltage signal, the predetermined high time during which the high level voltage is maintained is the output width of the voltage signal, and the cycle in which the high level voltage appears is the output cycle of the voltage signal. is there.

First, the overall flow of the mutual monitoring process between the main microcomputer 2 and the sub-microcomputer 3 will be described with reference to FIG.

FIG. 2 is a sequence chart showing an operation sequence of a mutual monitoring process performed between the main microcomputer and the sub-microcomputer of the vehicle electronic control device in the present embodiment.

As shown in FIG. 2, first, the sub-microcomputer 3 outputs a PWM signal SI1 indicating a self-diagnosis command to the main microcomputer 2 to the main microcomputer 2 as a self-diagnosis command signal (self-diagnosis command output processing). .

Next, the main microcomputer 2 diagnoses whether the output width and output cycle of the PWM signal SI1 input from the sub-microcomputer 3 are appropriate, and the output width and output cycle of the PWM signal SI1 are not appropriate. If it is determined, the sub-microcomputer 3 is determined to be abnormal (diagnostic) (self-diagnosis command appropriate determination process). Thus, when the main microcomputer 2 determines that the sub-microcomputer 3 is abnormal, the relay 6 is turned off by switching the relay drive control signal SI4 to the AND circuit 4 to a low level. On the other hand, when the main microcomputer 2 determines that the output width and output cycle of the PWM signal SI1 input from the sub-microcomputer 3 are appropriate, the PWM signal SI1 is appropriate as a self-diagnosis command from the sub-microcomputer 3 Therefore, the main microcomputer 2 performs a self-diagnosis (self-check) corresponding to the output width of the PWM signal SI1 (self-diagnosis process).

The main microcomputer 2 outputs the PWM signal SI2 indicating the self-diagnosis result to the sub-microcomputer 3 as a self-diagnosis result signal based on the self-diagnosis result of the self-diagnosis process (self-diagnosis result output process).

Next, the sub-microcomputer 3 monitors the PWM signal SI2 output from the main microcomputer 2, and diagnoses whether or not the self-diagnosis result of the main microcomputer 2 indicated by the input PWM signal SI2 is appropriate. (Appropriate diagnosis process). Then, the sub-microcomputer 3 outputs a pass / fail result as to whether or not the self-diagnosis result in the main microcomputer 2 is appropriate to the main microcomputer 2 as an appropriate diagnosis result signal SI3 (appropriate diagnosis result output processing). A series of mutual monitoring is performed by the process. Thereafter, such a series of mutual monitoring processes are repeatedly performed at a predetermined cycle. If the sub-microcomputer 3 determines that the self-diagnosis result in the main microcomputer 2 is not appropriate, the sub-microcomputer 3 determines that the main microcomputer 2 is abnormal, and the relay drive control signal SI5 to the AND circuit 4 is determined. Is switched to a low level to turn off the relay 6.

In the above mutual monitoring process, the self-diagnosis process in the main microcomputer 2 is not limited to one type of self-diagnosis process, and a plurality of types of self-diagnosis processes may be executed. In such a case, the sub-microcomputer 3 may sequentially issue a plurality of types of self-diagnosis commands, or may randomly issue commands. In addition, as such a plurality of types of self-diagnosis commands, the sub-microcomputer 3 may previously set PWM signals having different output widths corresponding to the plurality of types of self-diagnosis commands. In such a case, the main microcomputer 2 can output self-diagnosis results respectively corresponding to a plurality of types of self-diagnosis commands to the sub-microcomputer 3.

In the above mutual monitoring processing, the main microcomputer 2 determines whether or not it is appropriate for at least one of the output width and output cycle of the PWM signal as the self-diagnosis command signal input from the sub-microcomputer 3. May be performed. Further, the main microcomputer 2 may perform self-diagnosis corresponding to at least one of the output width and output cycle of the PWM signal as the self-diagnosis command signal input from the sub-microcomputer 3. The sub-microcomputer 3 may determine whether or not it is appropriate for at least one of the output width and output period of the PWM signal as the self-diagnosis result signal input from the main microcomputer 2.

In the above mutual monitoring process, if there is a margin in the processing capacity of the main microcomputer 2 and the sub-microcomputer 3, the main microcomputer 2 and the sub-microcomputer 3 are interchanged so that the main microcomputer 2 The self-diagnosis instruction output process, the appropriate diagnosis process, and the appropriate diagnosis result output process for the microcomputer 3 are executed, and the sub-microcomputer 3 can also execute the self-diagnosis instruction appropriateness determination process, the self-diagnosis process, and the self-diagnosis result output process.

Next, for the mutual monitoring process between the main microcomputer 2 and the sub-microcomputer 3 shown in FIG. 2, when one kind of self-diagnosis process is adopted and the output width and output cycle of one-pulse PWM signal are appropriately used This will be described in detail with reference to FIG.

First, processing when the sub-microcomputer 3 monitors and diagnoses the main microcomputer 2 will be described with reference to FIGS.

FIG. 3 is a flowchart showing the flow of processing when the sub-microcomputer of the vehicle electronic control device in this embodiment monitors and diagnoses the operation of the main microcomputer, and FIG. 4 mainly corresponds to the processing shown in FIG. It is a timing chart. In FIG. 4, the horizontal axis represents time t, the vertical axis represents voltage for each output (signal), and each determination step is schematically shown as a rectangular block.

As shown in FIG. 3, when the sub-microcomputer 3 monitors and diagnoses the main microcomputer 2 in response to the ignition switch SW being switched from the OFF state to the ON state, the sub-microcomputer is started in step S1. 3 CPU 3a outputs a PWM signal SI1 which is a self-diagnosis command signal to the CPU 2a of the main microcomputer 2. Here, as shown in FIG. 4A, at time T0, the self-diagnosis command signal SI1 is switched from the low level to the high level and has a predetermined pulse width which is an output width indicating the length of the high time. It is output as a PWM signal. Then, the CPU 3a advances the processing to the next step S2.

In step S2, the CPU 3a of the sub-microcomputer 3 inputs from the main microcomputer 2 a PWM signal SI2 that is a self-diagnosis result signal indicating a self-diagnosis result obtained by the main microcomputer 2 based on the output width of the self-diagnosis command signal SI1. Judge whether it has been done. Here, the PWM signal is output at time T1 shown in FIG. 4D, and the process of determining whether or not the PWM signal has been input starts from time T2 shown in FIG. 4C. If it is determined that the output of the PWM signal SI2 itself has not been made, the CPU 3a advances the process to step S3. On the other hand, when determining that the PWM signal SI2 is output, the CPU 3a advances the process to step S5. In FIG. 4C, each step after step S3 and each step after step S5 are also performed continuously after the determination step in step S2, and typically start at time T2 and start at time T3. This is schematically illustrated by the rectangular block in FIG.

In the process of step S3 when it is determined that the output of the PWM signal SI2 that is the self-diagnosis result signal is not made, the CPU 3a of the sub-microcomputer 3 outputs the self-diagnosis command signal SI1 to the main microcomputer 2 and then the predetermined process It is determined whether or not time (for example, time T2 shown in FIG. 4) has elapsed. If the predetermined time has not elapsed as a result of the determination, the CPU 3a returns the process to step S2. On the other hand, if the predetermined time has elapsed as a result of the determination, the CPU 3a advances the process to the next step S4.

In step S4, the CPU 3a of the sub-microcomputer 3 determines that an event such as the disconnection of the wiring connecting the main microcomputer 2 and the sub-microcomputer 3 has occurred, and ANDs the relay drive control signal SI5 at the low level. In addition to outputting to the circuit 4, the AND circuit 4 correspondingly outputs a low level relay drive signal SI 6 to the relay drive circuit 5. Then, the relay drive circuit 5 to which the low-level relay drive signal SI6 is input switches the relay 6 to the OFF state, whereby the supply of power from the battery 9 to the motor drive circuit 7 is stopped, and the electronic throttle motor M Driving is prohibited. Thereby, the process of step S4 is completed and this series of processes are complete | finished.

In step S5 when it is determined that the output of the PWM signal SI2 that is the self-diagnosis result signal has been made, the CPU 3a of the sub-microcomputer 3 outputs the output width and output of the self-diagnosis result signal SI2 output from the main microcomputer 2. It is determined whether or not the cycle matches the preset output width and output cycle. Specifically, the sub microcomputer 3 stores the output width of the self-diagnosis command signal SI1 output to the main microcomputer 2 in the memory, and the CPU 3a, based on the output width of the self-diagnosis command signal SI1, The output width and output period of the self-diagnosis result signal SI2 to be output from the main microcomputer 2 are calculated and obtained. Then, the CPU 3a determines that the output width and the output cycle of the self-diagnosis result signal SI2 that the main microcomputer 2 outputs as the result of the self-diagnosis is proper should be output from the main microcomputer 2 originally. It is determined whether or not the output width and output cycle of the diagnosis result signal are actually coincident with each other, thereby determining whether or not the self-diagnosis result output from the main microcomputer 2 is appropriate. As a result of the determination, when the self-diagnosis result output from the main microcomputer 2 is not appropriate, the CPU 3a advances the process to step S8. On the other hand, when the self-diagnosis result output from the main microcomputer 2 is appropriate, the CPU 3a advances the process to step S6.

In step S6 when it is determined that the self-diagnosis result output from the main microcomputer 2 is appropriate, the CPU 3a of the sub-microcomputer 3 makes a positive determination that the main microcomputer 2 does not have a defect, A proper diagnosis result signal SI3 indicating that no malfunction has occurred is output to the main microcomputer 2, and a PWM signal SI1 to be output to the main microcomputer 2 as a self-diagnosis command signal is prepared in the next processing. Here, as shown in FIG. 4B, the CPU 3a switches the appropriate diagnosis result signal SI3 from the low level to the high level at time T3. Then, the CPU 3a returns the process to the first step S1, and, as shown in FIG. 4A, the CPU 3a switches the self-diagnosis command signal from the low level to the high level at time T4, and outputs a PWM signal having a predetermined width. In addition to being output as SI1, whether or not the PWM signal SI2, which is a self-diagnosis result signal of the main microcomputer 2, was output at time T5 shown in FIG. 4D, and further for a predetermined time (for example, at time T6 shown in FIG. 4). Whether or not it is input to the CPU 3a within (time)) is determined in a determination process schematically shown as a rectangular block starting from time T6 indicated by C in FIG.

In the process of step S8 when it is determined that the self-diagnosis result output from the main microcomputer 2 is not appropriate, the CPU 3a of the sub-microcomputer 3 is negative if the main microcomputer 2 is defective in this process. Judgment is made, and the count value N of the program counter that counts the number of times that the process of step S8 has been executed, that is, the number of times that the main microcomputer 2 has been found to be defective, is incremented by one. Thereby, the process of step S8 is completed and the CPU 3a advances the process to the next step S9. Such a program counter is built in the CPU 3a.

In the process of step S9, the number of times N that the CPU 3a of the sub-microcomputer 3 determines that a failure has occurred in the main microcomputer 2 by determining whether or not the count value N of the program counter is greater than or equal to a predetermined value N0. Is determined to be greater than or equal to a predetermined value N0. As a result of the determination, if the number N of times when it is determined that a problem has occurred in the main microcomputer 2 is less than the predetermined value N0, the CPU 3a advances the process to step S10. On the other hand, when the number N of times when it is determined that a problem has occurred in the main microcomputer 2 is equal to or greater than the predetermined value N0, the CPU 3a advances the process to step S11.

In step S10 in the case where the number N of times when it is determined that a problem has occurred in the main microcomputer 2 is less than the predetermined value N0, the CPU 3a of the sub-microcomputer 3 indicates that the problem has occurred in the main microcomputer 2. A diagnostic result signal SI3 is output to the main microcomputer 2, and a PWM signal SI1 to be output as a self-diagnosis command signal to the main microcomputer 2 in the next processing is prepared. Here, for example, the output width and output cycle of the PWM signal SI2, which is a self-diagnosis result signal from the CPU 2a to the CPU 3a at time T5 in FIG. 4D, are incorrect, and the count value of the counter becomes less than the predetermined value N0. If the case is indicated by an alternate long and short dash line, the CPU 3a switches the appropriate diagnosis result signal from the high level to the low level at time T7 as shown in FIG. 4B. Then, the CPU 3a returns the process to the first step S1.

In step S11 in the case where the number N of times when it is determined that a failure has occurred in the main microcomputer 2 is equal to or greater than the predetermined value N0, the CPU 3a of the sub-microcomputer 3 determines a failure confirmation that a failure has occurred in the main microcomputer 2. Then, the low-level relay drive control signal SI5 is output to the AND circuit 4, and the AND circuit 4 correspondingly outputs the low-level relay drive signal SI6 to the relay drive circuit 5. Then, the relay drive circuit 5 to which the low-level relay drive signal SI6 is input switches the relay 6 to the OFF state, whereby the supply of power from the battery 9 to the motor drive circuit 7 is stopped, and the electronic throttle motor M Driving is prohibited. Thereby, the process of step S11 is completed and this series of processes are complete | finished.

In the main microcomputer 2, when there is a surplus in processing and communication when the control of the electronic throttle motor M is not executed or when the above-described processing according to the request of the sub-microcomputer 3 is not executed, the main microcomputer 2 The CPU 2a of 2 performs a self-check by performing a predetermined calculation corresponding to the PWM signal input as a self-diagnosis command output from the CPU 3a of the sub-microcomputer 3 or a signal by serial communication, and the self-diagnosis result is expressed as a specific numerical value. It is also possible to output a command to the CPU 2a of the sub-microcomputer 3 by serial communication.

Next, when the sub-microcomputer 3 monitors and diagnoses the main microcomputer 2, the main microcomputer 2 performs self-diagnosis and also diagnoses the sub-microcomputer with reference to FIG.

FIG. 5 is a flowchart showing a flow of processing executed by the main microcomputer along with processing when the sub-microcomputer of the vehicle electronic control device according to the present embodiment monitors and diagnoses the operation of the main microcomputer.

As shown in FIG. 5, when the CPU 2a of the main microcomputer 2 starts the process when the sub-microcomputer 3 monitors and diagnoses the operation of the main microcomputer 2, the CPU 3a of the sub-microcomputer 3 starts in step S111. The output width of the PWM signal SI1, which is a self-diagnosis command signal output from the. If the CPU 2a determines that the output of the PWM signal SI1 itself has not been made, the process proceeds to step S112. On the other hand, if the CPU 2a determines that the PWM signal SI1 has been output, the process proceeds to step S114. Here, the CPU 2a detects the PWM signal SI1 to be input and determines whether or not the self-diagnosis command signal is output in the determination process starting from time T0 'indicated by E in FIG. In FIG. 4E, each step after step S112 and each step after step S114 are also performed continuously after the determination step in step S111, and typically start at time T0 ′ and start at time T1. This is schematically shown by the rectangular block in E of FIG.

In the process of step S112 when it is determined that the output of the PWM signal SI1 as the self-diagnosis command signal is not made, the CPU 2a of the main microcomputer 2 performs a predetermined time (for example, at the time T0 ′ shown in FIG. 3). It is determined whether or not elapses. If the predetermined time has not elapsed as a result of the determination, the CPU 2a returns the process to the first step S111. On the other hand, if it is determined that the predetermined time has elapsed, the CPU 2a advances the processing to the next step S113.

In step S113, the CPU 2a of the main microcomputer 2 determines that an event such as the disconnection of the wiring connecting the main microcomputer 2 and the sub-microcomputer 3 has occurred, and ANDs the low-level relay drive control signal S14. In addition to outputting to the circuit 4, the AND circuit 4 correspondingly outputs a low level relay drive signal SI 6 to the relay drive circuit 5. Then, the relay drive circuit 5 to which the low-level relay drive signal SI6 is input switches the relay 6 to the OFF state, whereby the supply of power from the battery 9 to the motor drive circuit 7 is stopped, and the electronic throttle motor M Driving is prohibited. Thereby, the process of step S113 is completed and this series of processes are complete | finished.

In step S114 when it is determined that the output of the PWM signal SI1 that is a self-diagnosis command signal has been made, the CPU 2a of the main microcomputer 2 determines whether or not the current process is the first process. As a result of the determination, if the current process is the first time, the CPU 2a advances the process to step S116. On the other hand, if the current process is not the first time, the CPU 2a advances the process to step S115.

In step S115 when it is determined that this process is not the first time, the CPU 2a of the main microcomputer 2 determines whether the previous appropriate diagnosis result signal SI3 output from the sub-microcomputer 3 is at a high level or a low level. Make a decision. The information on the voltage level of the previous appropriate diagnosis result signal SI3 is stored in the memory of the main microcomputer 2 in the previous process performed before time T0 in FIG. If the appropriate diagnosis result signal SI3 from the sub-microcomputer 3 is at a high level, the CPU 2a determines that the previous self-diagnosis result of the main microcomputer 2 is appropriate, and advances the process to S116. On the other hand, if the appropriate diagnosis result signal SI3 is at a low level, the CPU 2a determines that the previous self-diagnosis result is not appropriate, and advances the process to S120.

In step S116 when the appropriate diagnosis result output from the sub-microcomputer 3 is appropriate, the CPU 2a of the main microcomputer 2 determines the output width and output cycle of the PWM signal SI1 that is a self-diagnosis command signal output from the sub-microcomputer 3. It is determined whether or not the output width and the output cycle set in advance coincide with each other. Specifically, the main microcomputer 2 stores a predetermined output width and a predetermined output period of a PWM signal, which is a self-diagnosis command signal that the sub-microcomputer 3 should output to the main microcomputer 2, in the memory, and the CPU 2a It is determined whether or not the output width and output cycle of the self-diagnosis command signal SI1 actually output from the sub-microcomputer 3 match the predetermined output width and predetermined output cycle. As a result of the determination, if the output width and output cycle of the self-diagnosis command signal SI1 output from the sub-microcomputer 3 do not match the predetermined output width and predetermined output cycle, the CPU 2a advances the process to step S120. On the other hand, when the output width and output cycle of the self-diagnosis command signal SI1 output from the sub-microcomputer 3 match the predetermined output width and the predetermined output cycle, the CPU 2a advances the process to step S117.

In step S117 when the output width and output cycle of the self-diagnosis command signal SI1 output from the sub-microcomputer 3 coincide with the predetermined output width and predetermined output cycle, the CPU 2a of the main microcomputer 2 further A predetermined calculation corresponding to the PWM signal SI1 input as a self-diagnosis command output from the CPU 3a is performed to perform self-check (self-diagnosis), and the process proceeds to the next step S118. Examples of the predetermined calculation in the self-check include a calculation performed by a predetermined calculation expression stored in the memory of the main microcomputer 2 based on the output width of the input PWM signal SI1.

In step S118, the CPU 2a of the main microcomputer 2 outputs a self-diagnosis result signal indicating the result of the self-check to the sub-microcomputer 3 as the PWM signal SI2. Here, as shown in FIG. 4D, the CPU 2a outputs the PWM signal SI2 as a self-diagnosis result signal at time T1. Then, the CPU 2a returns the process to the first step S111.

When it is determined that the appropriate diagnosis result signal SI3 output from the sub-microcomputer 3 is not appropriate, and the output width and output cycle of the self-diagnosis command signal SI1 output from the sub-microcomputer 3 are equal to the predetermined output width and the predetermined output cycle. In the process of step S120 when it is determined that it has not been performed, the CPU 2a increments the count value N of the program counter that counts the number of times of executing the process of step 120 by one. Thereby, the process of step S120 is completed, and the CPU 2a advances the process to the next step S121. Such a program counter is built in the CPU 2a.

In step S121, the CPU 2a of the main microcomputer 2 determines whether or not the count value N of the program counter is equal to or greater than a predetermined value N0. As a result of the determination, if the count value N of the program counter is less than the predetermined value N0, the CPU 2a returns the process to the first step S111. On the other hand, when the count value N of the program counter is equal to or greater than the predetermined value N0, the CPU 2a advances the process to the next step S122.

In step S122 in the case where the count value N of the program counter is equal to or greater than the predetermined value N0, the CPU 2a of the main microcomputer 2 finally makes a negative determination that a problem has occurred in the main microcomputer 2, and the low level relay The drive control signal SI4 is output to the AND circuit 4, and the AND circuit 4 correspondingly outputs a low level relay drive signal SI6 to the relay drive circuit 5. Then, the relay drive circuit 5 to which the low-level relay drive signal SI6 is input switches the relay 6 to the OFF state, whereby the supply of power from the battery 9 to the motor drive circuit 7 is stopped, and the electronic throttle motor M Driving is prohibited. Thereby, the process of step S122 is completed and this series of processes are complete | finished. Note that the low-level relay drive control signal SI5 for the AND circuit 4 in the process of monitoring and diagnosing the main microcomputer 2 by the sub-microcomputer 3 described above, and the low-level drive control for the AND circuit 4 in the process of the main microcomputer 2 described here. If at least one of the signals SI4 is input to the AND circuit 4, the AND circuit 4 correspondingly outputs a low level relay drive signal SI6 to the relay drive circuit 5, and the low level relay drive signal SI6 is input. The relay drive circuit 5 switches power supply from the battery 9 to the motor drive circuit 7 by switching the relay 6 to the OFF state, and prohibits driving of the electronic throttle motor M.

According to the configuration of the vehicle electronic control device of the present embodiment described above, the microcomputer is diagnosed mainly using the PWM signal instead of the serial communication, so that the microcomputer can be diagnosed quickly and reliably.

It should be noted that the present invention is not limited to the above-described embodiments in terms of the type, arrangement, number, etc. of the constituent elements, and deviates from the gist of the invention, such as appropriately replacing the constituent elements with those having the same effects. Of course, it can be appropriately changed within the range not to be.

As described above, in the present invention, the diagnosis of the microcomputer is performed mainly using the PWM signal instead of the serial communication. Therefore, the vehicle electronic control device capable of diagnosing the microcomputer quickly and surely is provided. It is expected that it can be widely applied to electronic control devices such as vehicles because of its universal universal character.

Claims

A vehicle electronic control device comprising: a first microcomputer; and a second microcomputer capable of transmitting and receiving signals between the first microcomputer,
Of the first microcomputer and the second microcomputer, one microcomputer outputs a voltage signal representing a high level and a low level voltage to the other microcomputer, and the other microcomputer outputs the voltage signal. Detecting a high time during which the voltage is at the high level and executing a self-diagnosis according to the detected high time, and outputting the result of the self-diagnosis to the one microcomputer, wherein the one microcomputer An electronic control unit for a vehicle that diagnoses the other microcomputer based on the result of the self-diagnosis.
The vehicle electronic control device according to claim 1, wherein the voltage signal is a PWM signal.
3. The other microcomputer performs diagnosis of the one microcomputer based on at least one of the high time and the period of the PWM signal input from the one microcomputer. The electronic control apparatus for vehicles as described.
The other microcomputer outputs the result of the self-diagnosis to the one microcomputer as a PWM signal, and the one microcomputer detects the other microcomputer based on at least one of a high time and a period of the PWM signal. 2. The vehicle electronic control device according to claim 1, wherein diagnosis is performed.
2. The vehicle electronic control device according to claim 1, wherein the other microcomputer further outputs the result of the self-diagnosis to the one microcomputer via serial communication.
Further, the other microcomputer diagnoses the one microcomputer, and one of the diagnosis of the other microcomputer by the one microcomputer and the diagnosis of the one microcomputer by the other microcomputer is denied. The vehicular electronic control device according to claim 1, wherein the operation of the control target of the vehicular electronic control device is prohibited when it is a target.